jupiternexus[.]fun

Analysis indicates that the domain jupiternexus.fun is being leveraged in a brand‑impersonation campaign that claims to be associated with the Jupiter brand and is classified as a cryptocurrency scam. The site was registered through NameSilo, LLC on March 17, 2026 and resolves to the Cloudflare‑provided address 172.67.222.159, which maps to the United States under ASN 13335 (Cloudflare, Inc.). The domain is serviced by Cloudflare and presents Cloudflare Browser Insights and HTTP/3 support, suggesting a typical Cloudflare front‑end configuration. DNS resolution is handled by the authoritative nameservers kehlani.ns.cloudflare.com and mark.ns.cloudflare.com.

VirusTotal analysis shows that three of ninety‑four security vendors have flagged the domain, providing an early indication of malicious activity. Independent security blocklists record the domain on three separate listings, and it is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing the view that the infrastructure is being used to lure cryptocurrency users. The page title returned during the last probe was "Just a moment...," but the site was taken offline before a full content capture could be performed, leaving the exact payload and user‑interaction flow unverified.

Given the brand‑impersonation angle, the elevated risk rating, and the observed blocklist activity, defenders should treat jupiternexus.fun as a hostile indicator. Recommended actions include adding the domain and its associated IP address to firewall deny lists, monitoring for newly registered domains that share the same Cloudflare nameservers, and alerting endpoint protection solutions that integrate threat intelligence feeds to block any connections to this host. Continuous re‑evaluation is advised, as the offline status may be temporary and the infrastructure could be re‑activated under a different domain or subdomain.